- Freeradius-Users - lists.freeradius.org

about eap_handler
by blue_11j＠yahoo.co.jp 26 Jun '08

26 Jun '08

Hi, I'm sorry that I am not good at English because I'm Japanese... I have a question about eap_handler. I understand that... if radiusd recieved EAP-Identify packet, eap_handler is allocated and added to eaplist. if radiusd will be not received next EAP packet(except EAP-Identiry) forever, When is the eap_handler deleted from the eaplist and freed ? will radiusd use too large memory by 'Dos attack using EAP-Identiry' ? -------------------------------------- GANBARE! NIPPON! Chance to win 50,000 Yahoo! Points! http://pr.mail.yahoo.co.jp/ganbare-nippon/

3 14

problems with building freeradius on solaris 10
by Ubale, Abhishek Amarnath 26 Jun '08

26 Jun '08

Hi Everyone, Im trying to build freeradius on a solaris10 sparx box. im only interested in rlm_perl modules of freeradius and I face no issues with "configure" ./configure --prefix=/usr/local/radius --without-threads --with-static-modules="rlm_perl" --without-rlm_sql --without-rlm_eap --without-rlm_ldap --without-rlm_krb5 --without-rlm_python --without-rlm_counter --without-rlm_ippool --without-rlm_otp but my make is erroring out with following error: In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:41, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/token.h:27: warning: `used' attribute directive ignored In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:42, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/hash.h:28: warning: `used' attribute directive ignored In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:54, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/md4.h:13: warning: `used' attribute directive ignored In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:466, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/packet.h:28: warning: `used' attribute directive ignored gcc -g -O2 -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.10\" -DRADIUSD_VERSION=\"2.0.4\" -DNO_OPENSSL -c crypt.c -o crypt.o >/dev/null 2>&1 /var/tmp/freeradius-server-2.0.4/libtool --mode=compile gcc -g -O2 -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.10\" -DRADIUSD_VERSION=\"2.0.4\" -DNO_OPENSSL -c exec.c gcc -g -O2 -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.10\" -DRADIUSD_VERSION=\"2.0.4\" -DNO_OPENSSL -c exec.c -fPIC -DPIC -o .libs/exec.o exec.c:226: macro `rad_fork' used without args gmake[4]: *** [exec.lo] Error 1 gmake[4]: Leaving directory `/var/tmp/freeradius-server-2.0.4/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/var/tmp/freeradius-server-2.0.4/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/var/tmp/freeradius-server-2.0.4/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/var/tmp/freeradius-server-2.0.4' make: *** [all] Error 2 Please help. thanks Abhishek

1 1

accsessionid in SQL schemas is too short
by Giovanni Lovato 25 Jun '08

25 Jun '08

In SQL schemas, accsessionid as VARCHAR(32) is too short, some NAS (e.g. Juniper ERX) send to RADIUS long Acct-Session-Id (up to 48 chars). I manually set it to VARCHAR(64) and now it seems to work correctly.

1 0

About ipaddr
by ELOM ETSE 25 Jun '08

25 Jun '08

Hi! I installed and configured the server freeRADIUS. When i didn't fill the ipaddr field or fill it with 127.0.0.1, all seem going well. But when i specify this field with an address of 192.168.1.0 network, i have this result: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.2.1 port = 1812 ERROR: Failed to open socket: cannot bind socket: Cannot assign requested address /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 192.168.2.1 port 1812 Please Where is the problem? Can i use localhost address for ipaddr field? or fill with *? With what can i fill the acess point security field? Please help me because i'am installing this server since saturday but no good result. Thanks _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

I need to cancel or to active a user with a new attrib "Canceled" that I have added to radcheck table, in the authenticate stage.
by Jose Maira Iranzo Marin 25 Jun '08

25 Jun '08

I need to cancel or to active a user with a new attrib Canceled that I have added to radcheck table, in the authenticate stage. But I dont know if this method is the correct. Can you help me? Un saludo ------------------------------------------------------------ Jose María Iranzo Marín ---------- HYPERLINK "mailto:jmiranzo@simauria.net"jmiranzo(a)simauria.net ------------------------------------------------------------ Simauria Networks - HYPERLINK "http://www.simauria.net"www.simauria.net C/ Velázquez, 24 bajo. 46018 Valencia Tlf: +34 902.877.206 - Fax: +34 902.929.028 ------------------------------------------------------------- No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.4.0/1509 - Release Date: 19/06/2008 8:00

2 2

Bill Gates on using WiFi on Windows.
by Alan DeKok 25 Jun '08

25 Jun '08

The following article about Bill Gates trying to install software has a gem near the bottom: http://blog.seattlepi.nwsource.com/microsoft/archives/141821.asp The lack of attention to usability represented by these experiences blows my mind. I thought we had reached a low with Windows Network places or the messages I get when I try to use 802.11. (don't you just love that root certificate message?) i.e. The wireless networking experience is a "low" for Windows. So for everyone on this list fighting with Windows: It's not just you. Bill Gates has the exact same problems. Alan DeKok.

1 0

Web-based OTP authentication
by Jaishankar J 25 Jun '08

25 Jun '08

Hi, I have a server which can authenticate a phone-generated counter-based OTP using a web-service (http or https). Can anyone suggest the easiest method for integrating that authentication method with the latest version of FreeRadius? I have looked at PAM and rlm_otp, but was wondering if there is a way in which I can call the web-service from a tool using exec-wait. My idea is to use the FreeRadius at the edge to receive the RADIUS requests and then pass the username and OTP using the web-service for authentication. Thanks in advance, Jai

2 1

Limiting Wifi Access
by Roy Kartadinata 25 Jun '08

25 Jun '08

Hi guys, We're trying to centralize our corporate wifi authentication using freeradius. So far, I was able to get user to authenticate based on NAS IP (I got access to multiple NAS working as well) and Mac Address. Is it possible to also limit their access per SSID? The reason for this is because one of our locations, our HQ, has 3 SSID and only certain people have access to certain SSID but I'm not sure if this will conflict with already working NAS checking. Our HQ is using Cisco Wireless LAN Controller so all 3 SSID will connect to radius using the same NAS IP. Cheers, Roy Kartadinata

4 4

Goodbye SNMP, hello statistics.
by Alan DeKok 24 Jun '08

24 Jun '08

I've commited some code (~1K LoC) to CVS head that will go into 2.0.6. In short, there's no point in using SNMP any more. The good news is that the Status-Server packet is overloaded to get all sorts of statistics that weren't available in SNMP. For more information, see: share/dictionary.freeradius Some comments: - the statistics can ONLY be queried from localhost. This will not be changed. - You can ask for ALL auth statistics (across all "listen" sockets) - Or, specify a socket IP/port, and it will return the stats for that socket. - You can do this for auth/acct sockets independently - you can query statistics for one client, and optionally specify the server IP/port (if the "listen" section has it's own clients) - you can ask for total auth/acct packets that are proxied to home servers - you can ask for total auth/acct packets that are sent to individual home servers. - you can tell when a home server was marked dead / alive, and how many requests have been sent, but not responded to. - you can ask for stats on the internal queues in the server (e.g. if it's busy, there will be many packets waiting, and all of the child threads will be doing work) The end result is that it's simpler to implement than SNMP, has fewer issues, and returns more data than the SNMP statistics would return. Enjoy. Alan DeKok.

6 12

Re: tnc server with libtnc
by Ingo Bente 24 Jun '08

24 Jun '08

> Fernando wrote: >> Alan DeKok wrote: >>> Fernando wrote: >>> >>>> I have read in list that, *Steffen Bartsch *was planning to develop a >>>> module for a TNC server linking freeradius with libtnc. (in 2007) >>>> >>>> Does someone know something about it? >>>> >>> Download the latest version of the server. Look for the TNC module. >>> >>> >> The last version works with libtnc? > callTNCS = (ExchangeTNCCSMessagePointer) getProcAddress(handle, > "exchangeTNCCSMessages"); > This is the link to perform a dialog between Freeradius and the > TNCS? The EAP-TNC method was developed by the TNC@FHH project. The current EAP-method that is part of FreeRADIUS is outdated. See http://tnc.inform.fh-hannover.de for further information. You will need to download - the latest FreeRADIUS EAP-TNC patch - TNC@FHH packages As TNC client, I suggest that you use wpa_supplicant. Considering libtnc: TNC@FHH and the FreeRADIUS EAP-TNC patch don't use libtnc. But TNC@FHH works with libtnc. That is, you can write your own IMCs/IMVs based on libtnc and use them together with TNC@FHH, FreeRADIUS and wpa_supplicant. Ingo Sorry for sending this twice. Forgot to change the subject in the first place.

1 0